6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe
Size

1.4MB
MD5

86d7f19f16003c2e94d98b0465becd8a
SHA1

d8f436419da4455ca6482d0e0c4be42912fe9843
SHA256

6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25
SHA512

8f18b6e70a6751d5f86be22b8629e196b4f7a1dd9b84d93c0ef4d14c1e094a1788da10e3b5ce1cb9be9aa17b7065719a66bf9c4341befc4798acdb632dfbbc01
SSDEEP

24576:b8zXcqZ1zuNWvycWBynTOUCR2pRyHZlcE2cWLWh5ZwiWjiA6bfOQIk0j+t4RXtAJ:wzXc2sNIXDRyHDcPcWSHuilZVIk0j+yM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe

description	pid	process	target process
PID 2472 set thread context of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2636 1332 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2636	1332	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exeAppLaunch.exe

description	pid	process	target process
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 2472 wrote to memory of 1332	2472	6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe	AppLaunch.exe
PID 1332 wrote to memory of 2636	1332	AppLaunch.exe	WerFault.exe
PID 1332 wrote to memory of 2636	1332	AppLaunch.exe	WerFault.exe
PID 1332 wrote to memory of 2636	1332	AppLaunch.exe	WerFault.exe
PID 1332 wrote to memory of 2636	1332	AppLaunch.exe	WerFault.exe
PID 1332 wrote to memory of 2636	1332	AppLaunch.exe	WerFault.exe
PID 1332 wrote to memory of 2636	1332	AppLaunch.exe	WerFault.exe
PID 1332 wrote to memory of 2636	1332	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe
"C:\Users\Admin\AppData\Local\Temp\6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 200
3⤵
- Program crash
PID:2636

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-0-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1332-1-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1332-2-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1332-3-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1332-4-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1332-7-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1332-5-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1332-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1332-9-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1332-11-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download